F:\vcpkg\buildtrees\guetzli\x64-windows-rel\guetzli.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4.exe
Resource
win10v2004-20240802-en
General
-
Target
e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4
-
Size
254KB
-
MD5
6ad412e21723d6a882473c461b4d7074
-
SHA1
a27c2ee805cf7ed8f7ae43e8f34a27d9c51ae846
-
SHA256
e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4
-
SHA512
c3d7f15fd58920cbddc9dbccb2777aa44c6b10ddc6677b8a29b2dfbe9a9a73484ac34b7bbe3638e8858825c1abce52fd536a37f7030897162c1ba80a90091b22
-
SSDEEP
6144:ClTReUemn+PvsuVzjvHobBSwvN2RzMT+v:ClTym+PvslN2RQT+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4
Files
-
e20903900786c4ae409821ea8a9ec30f79aa56ce6966d8836dfca2ef2468d7d4.exe windows:6 windows x64 arch:x64
d71bde0a8210aeeb28c053defab65c94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
libpng16
png_set_longjmp_fn
png_read_png
png_get_image_height
png_get_image_width
png_get_channels
png_get_rows
png_error
png_get_io_ptr
png_set_read_fn
png_destroy_read_struct
png_create_info_struct
png_create_read_struct
msvcp140
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
?eof@ios_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xbad_alloc@std@@YAXXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
vcruntime140
memcmp
_purecall
__std_terminate
__intrinsic_setjmp
__C_specific_handler
__current_exception
__current_exception_context
memset
__std_exception_copy
__std_exception_destroy
memmove
longjmp
_CxxThrowException
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
terminate
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
abort
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_crt_atexit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
set_terminate
perror
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vfprintf
_set_fmode
__p__commode
fwrite
fseek
fread
fopen
ferror
feof
fclose
__acrt_iob_func
ftell
api-ms-win-crt-string-l1-1-0
strcmp
strnlen
strncmp
api-ms-win-crt-math-l1-1-0
expf
sqrtf
round
exp
sqrt
pow
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
RtlVirtualUnwind
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RtlLookupFunctionEntry
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
Sections
.text Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ